INDIANAPOLIS — A recent report indicates Hoosiers should keep an even closer eye on their daily mail deliveries.

The April report from the U.S. Postal Service Office of the Inspector General showed a 167% increase in the number of fraudulent changes of address performed on the USPS Moversguide website.  According to the report, cases of change of address (COA) fraud and attempted identity theft jumped from 8,857 in 2020 to 23,606 in 2021.

Change of address fraud can include a scammer using online tools to change a victim’s address in order to redirect their mail to another location. Instead of reaching into your mailbox to steal your mail, they can forward it straight to them.

Indiana University Cyber Security Program Director, Scott Shackelford says the increase in online COA fraud coincided with an increase in cyber crimes during the COVID-19 pandemic, when millions of Americans suddenly pivoted to working online from home.

“My guess is what we’re seeing in these data is just one aspect of this much bigger trend that unfortunately has been going on for a few years now,” Shackelford said.

The OIG report concluded that the USPS did not have sufficient online security on the Moversguide.

“The Postal Service did not implement effective identity verification controls on Moversguide and charged customers $1.10 for identity verification services that it did not provide,” the report stated.

“At the minimum, it’s really important to enable multi-factor authentication,” Shackelford said. “If they would have mandated multi-factor authentication for all of these different change of address requests, it would have made it a lot harder for somebody else to go in and try to change your address without you being aware of it.”

As CBS4 has reported, stolen mail often ends up on the “dark web,” where crooks buy and sell victims’ personal information.  While most people would likely notice if they suddenly stopped receiving mail for a couple days, by the time a victim realizes the problem and resolves it with the post office, Shackelford says a savvy scammer can do a lot of damage.

“By the time that mail gets redirected, they can already be gathering a ton of additional personal information about somebody.”

Online COA forms made up 56% of the nearly 36 million change of address requests across the nation in 2021.

USPS management disagreed with the OIG report’s conclusion about security lapses.

“Management has thoroughly assessed the risk, cost, and failure rate of options and continues to assess the current controls as sufficient,” a response letter stated.  “Therefore, Management disagrees with this recommendation and will continue to assess opportunities to improve identity verification and security controls.”  

USPS management also stated that following the OIG recommendations would harm millions of customers “to achieve an incremental risk reduction for several thousand customers.”

If you ever notice a disruption in your mail service, even for a day or two, Shackelford recommends immediately calling your local post office to make sure your address hasn’t been changed.

“You can also potentially take the next step of putting a fraud alert on your credit report,” he said.  “Or even just freezing your credit, and that makes it really really for anybody else to open an account or change your address or anything like that in your name without you being aware of it.”

The U.S. Postal Inspector also offered the following information:

When a change of address (COA) is submitted, the Postal Service mails a “Move Validation Letter” to the original address. While it doesn’t disclose the forwarding address, it does advise the consumer to contact the Postal Service through its toll-free number if there is any problem. A similar letter known as the “Confirmation Notification Letter” is also sent to the new address (the forwarding address) within five Postal business days before the COA start date.

Customers are encouraged to monitor the receipt of their mail, by retrieving it daily from their mailbox or through Informed Delivery online. Informed Delivery is a free and optional notification feature that gives residential consumers the ability to digitally preview their letter-sized mail and manage their packages scheduled to arrive soon. Customers are encouraged to register for Informed Delivery. Any suspicious activity, or non-receipt of mail over a couple days should be reported to their local Post Office, or they should contact the Postal Service at the toll-free number 800-ASK-USPS (800-275-8777) or USPS.com.

Customers should also be aware of financial statements received for accounts which are in their name, or their address, but they do not recognize. If customers receive these statements, they should immediately contact the financial institution and ask to speak to the fraud department. Additionally, customers can obtain a free credit report at annualcreditreport.com.  Customers can review the reports for unauthorized activity up to three times a year (they may order one from any one credit bureau every four months). They should report any accounts they did not open.